A firewall audit tool that reads the rules themselves.
SAMURAI is a self-hosted firewall audit tool. It reads security policies, NAT, objects and VPNs straight from Palo Alto, FortiGate, Cisco FMC/FTD, ASA and Juniper SRX, flags shadowed, redundant and overly broad rules, and works out what each rule really permits. Every change comes with the admin who made it, so your next audit is an export rather than a week of screenshots.
Updated July 2026
What it checks
Rule hygiene findings
Shadowed, redundant and overly broad rules across the whole rule base. Auditors look for these first.
Effective access
What each rule actually permits, with objects expanded and NAT applied, not just what the rule text says.
Who changed it
Every policy change is detected from device state and tied to an admin, so “who changed this, and when?” has a written answer.
History you can diff
Compare the configuration at any two points in time, including changes that never made it into an audit log.
One audit, all vendors
Palo Alto, FortiGate, Cisco FMC/FTD/ASA and Juniper SRX in a single audit, plus the ACLs on routers, switches and ACI fabrics.
Evidence you can hand over
Export any table to CSV, XLSX, HTML or PDF, whether it’s the rule inventory, the hygiene findings or the change timeline.
Configuration audit vs log-based reporting
A firewall audit asks what the rules are, whether they’re clean, and who changed them. Those are configuration questions. Log-based reporting tools answer a different one: what traffic went through.
Data source
SAMURAI
Configuration read from the device
Log-based reporting tools
Syslog and traffic logs
What the audit shows
SAMURAI
Rules, hygiene findings, effective access, who changed what
Log-based reporting tools
What traffic passed or got denied
Change accountability
SAMURAI
Every change tied to an admin
Log-based reporting tools
Not what log reports are for
Scope
SAMURAI
Firewalls plus routers, switches, ACI, ISE and vCenter
Log-based reporting tools
Usually firewall logs only
Logs matter for traffic forensics. Most firewall audits, though, want to know what the rules are, whether they’re clean and who changed them, and that’s what SAMURAI answers. It doesn’t run recertification campaigns; it produces the analysis those campaigns rely on.
Frequently asked questions
What is a firewall audit tool?
Software that reads firewall configuration and helps you check it: what the rules permit, whether any are shadowed, redundant or overly broad, and who changed them since the last review. SAMURAI does this from configuration across Palo Alto, FortiGate, Cisco and Juniper, and exports the evidence.
How do I audit firewall rules with it?
Add your firewalls. SAMURAI syncs their configuration and runs the Policy Analyzer over each rule base, giving you hygiene findings, effective access per rule and a change timeline showing who made each change. All of it is searchable and exportable. Our firewall audit checklist walks through the full process.
Is this a firewall log audit tool?
No. It audits configuration: the rules, objects and NAT read from each device, plus every change to them. For traffic forensics, pair it with a log platform.
Can it prove who changed a firewall rule?
Yes. Changes are detected from device state and tied to an admin: by commit on PAN-OS, by transaction on APIC, and by time window on FortiOS, ISE and vCenter. The audit trail names the person, not just the change.
Does it generate compliance reports?
It exports the rule inventory, hygiene findings and change history to CSV, XLSX, HTML or PDF, which is the evidence most audits ask for. It also runs 140+ CIS checks on Cisco IOS-XE, NX-OS, IOS-XR and ASA. It doesn’t produce framework certification attestations.
Which firewalls can it audit?
Palo Alto (PAN-OS), FortiGate (FortiOS), Cisco FMC/FTD and ASA, and Juniper SRX (Junos OS), plus the ACLs on Cisco routers, switches and ACI fabrics.